Exploitdb Exploits

31,394 exploits tracked across all sources.

Sort: Activity Stars
CVE-2009-3153 EXPLOITDB text VERIFIED
x10 MP3 Search Engine 1.6.5 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, id parameter to (3) templates/header1.php and (4) mp3/lyrics.php, key parameter to (5) video_listing.php and (6) adult/video_listing.php, and name parameter to (7) mp3/embed.php and (8) mp3/info.php.
by Moudi
CVE-2009-3153 EXPLOITDB text VERIFIED
x10 MP3 Search Engine 1.6.5 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, id parameter to (3) templates/header1.php and (4) mp3/lyrics.php, key parameter to (5) video_listing.php and (6) adult/video_listing.php, and name parameter to (7) mp3/embed.php and (8) mp3/info.php.
by Moudi
CVE-2009-3153 EXPLOITDB text VERIFIED
x10 MP3 Search Engine 1.6.5 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, id parameter to (3) templates/header1.php and (4) mp3/lyrics.php, key parameter to (5) video_listing.php and (6) adult/video_listing.php, and name parameter to (7) mp3/embed.php and (8) mp3/info.php.
by Moudi
CVE-2009-3153 EXPLOITDB text VERIFIED
x10 MP3 Search Engine 1.6.5 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, id parameter to (3) templates/header1.php and (4) mp3/lyrics.php, key parameter to (5) video_listing.php and (6) adult/video_listing.php, and name parameter to (7) mp3/embed.php and (8) mp3/info.php.
by Moudi
CVE-2009-3153 EXPLOITDB text VERIFIED
x10 MP3 Search Engine 1.6.5 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, id parameter to (3) templates/header1.php and (4) mp3/lyrics.php, key parameter to (5) video_listing.php and (6) adult/video_listing.php, and name parameter to (7) mp3/embed.php and (8) mp3/info.php.
by Moudi
CVE-2009-3153 EXPLOITDB text VERIFIED
x10 MP3 Search Engine 1.6.5 - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, id parameter to (3) templates/header1.php and (4) mp3/lyrics.php, key parameter to (5) video_listing.php and (6) adult/video_listing.php, and name parameter to (7) mp3/embed.php and (8) mp3/info.php.
by Moudi
CVE-2009-4717 EXPLOITDB text VERIFIED
Gonafish WebStatCaffe - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4) nopagesmost parameter to stat/mostvisitpagechart.php, and date parameter to (5) pageviewers.php, (6) pageviewerschart.php, and (7) referer.php in stat/.
by Moudi
CVE-2009-4717 EXPLOITDB text VERIFIED
Gonafish WebStatCaffe - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4) nopagesmost parameter to stat/mostvisitpagechart.php, and date parameter to (5) pageviewers.php, (6) pageviewerschart.php, and (7) referer.php in stat/.
by Moudi
CVE-2009-4717 EXPLOITDB text VERIFIED
Gonafish WebStatCaffe - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4) nopagesmost parameter to stat/mostvisitpagechart.php, and date parameter to (5) pageviewers.php, (6) pageviewerschart.php, and (7) referer.php in stat/.
by Moudi
CVE-2009-4717 EXPLOITDB text VERIFIED
Gonafish WebStatCaffe - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4) nopagesmost parameter to stat/mostvisitpagechart.php, and date parameter to (5) pageviewers.php, (6) pageviewerschart.php, and (7) referer.php in stat/.
by Moudi
CVE-2009-4717 EXPLOITDB text VERIFIED
Gonafish WebStatCaffe - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4) nopagesmost parameter to stat/mostvisitpagechart.php, and date parameter to (5) pageviewers.php, (6) pageviewerschart.php, and (7) referer.php in stat/.
by Moudi
CVE-2009-4717 EXPLOITDB text VERIFIED
Gonafish WebStatCaffe - Cross-Site Scripting via Multiple Parameters
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4) nopagesmost parameter to stat/mostvisitpagechart.php, and date parameter to (5) pageviewers.php, (6) pageviewerschart.php, and (7) referer.php in stat/.
by Moudi
EIP-2026-112809 EXPLOITDB text VERIFIED
Tukanas Classifieds 1.0 - 'index.php' SQL Injection
by Moudi
CVE-2009-3117 EXPLOITDB text VERIFIED
Snow Hall Silurus System 1.0 - SQL Injection via ID Parameter
SQL injection vulnerability in category.php in Snow Hall Silurus System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
by Mr.SQL
CVE-2009-3124 EXPLOITDB text VERIFIED
QuarkMail - Path Traversal via get_message.cgi tf Parameter
Directory traversal vulnerability in get_message.cgi in QuarkMail allows remote attackers to read arbitrary files via a .. (dot dot) in the tf parameter.
by Securitylab.ir
EIP-2026-110224 EXPLOITDB text VERIFIED
Open Classifieds - Multiple Cross-Site Scripting Vulnerabilities
by Moudi
EIP-2026-107147 EXPLOITDB text VERIFIED
FlexCMS 2.5 - 'CookieUsername' Cookie SQL Injection
by Inj3ct0r
CVE-2009-3613 EXPLOITDB text VERIFIED
Linux Kernel < 2.6.27.22 - Denial of Service via r8169 Driver Jumbo Frame Handling
The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping.
by Alistair Strachan
CVE-2009-2852 EXPLOITDB text VERIFIED
WP-Syntax < 0.9.1 - Remote Code Execution via test_filter[wp_head] Parameter
WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.
by Raz0r
CVE-2009-3123 EXPLOITDB text VERIFIED
visavi wap-motor < 18.0 - Path Traversal via Image Parameter
Directory traversal vulnerability in gallery/gallery.php in Wap-Motor before 18.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the image parameter.
by Inj3ct0r
CVE-2009-3116 EXPLOITDB text VERIFIED
Uiga Church Portal - SQL Injection via Year Parameter in Calendar Action
SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the year parameter in a calendar action.
by Mr.SQL
CVE-2009-3187 EXPLOITDB text VERIFIED
Standalonearcade Saa - XSS
Cross-site scripting (XSS) vulnerability in gamelist.php in Stand Alone Arcade 1.1 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
by Moudi
EIP-2026-112230 EXPLOITDB text VERIFIED
Smart Magician Blog 1.0 - Multiple SQL Injections
by Evil-Cod3r
CVE-2009-3193 EXPLOITDB text VERIFIED
uwix com_digifolio 1.52 - SQL Injection via id Parameter
SQL injection vulnerability in the DigiFolio (com_digifolio) component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
by v3n0m
EIP-2026-107206 EXPLOITDB text VERIFIED
Free Arcade Script 1.0 - 'search' Cross-Site Scripting
by 599eme Man
By Source
All 31,394 Writeup 64,858 Exploitdb 50,095 Nomisec 23,005 Github 4,813 Metasploit 3,318 Vulncheck_xdb 946 Inthewild 514 Gitlab 490 Gitee 415 Patchapalooza 312
By Language
text 31,394 python 7,192 ruby 6,011 c 3,677 perl 2,849 html 2,082 php 1,341 bash 462 java 412 c++ 338 shell 282 javascript 241 go 85 typescript 30 postscript 25